CVE-2026-78623

Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores

No known exploitation. EPSS puts it in the 36th percentile. A vendor fix is available.

CVSS 3.17.7High EPSS percentile36th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run Okta Access Gateway with Advanced Mode datastore settings.
Confirm the appliance version; systems below 2026.9.1 need remediation.
Upgrade Okta Access Gateway to version 2026.9.1 or later.
Review database activity and SAML assertion processing for unexpected queries or changes.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.

In plain language

Written by AI from the record

Okta Access Gateway Advanced Mode Datastores before 2026.9.1 let a low-privileged user tamper with the connected database, so affected small businesses should act urgently.

Authenticated SQL injection through unsanitized SAML assertion attributes in Okta Access Gateway Advanced Mode datastore query handling can execute unauthorized database commands.

If you're affected

Backend database compromise
Sensitive data exposure
Unauthorized data changes
Service disruption

What is it

This flaw can let a user with a basic account put harmful instructions into information passed through the gateway, which are then acted on by its connected database. It is like a receptionist accepting a forged instruction slip and handing it directly to the records room, where it can alter or expose business records.

Who is affected

This matters to you if you run Okta Access Gateway and use its Advanced Mode datastore settings. An attacker needs an account with low-level access, but does not need to trick another person into clicking anything.

How urgent is it

A logged-in attacker can use this flaw to issue unauthorized commands to the backend database. Treat this as urgent because database access can expose or alter the information and services your gateway depends on.

What to do — in detail

Confirm whether each Okta Access Gateway appliance uses an Advanced Mode datastore and identify its installed release. Upgrade every affected appliance to 2026.9.1 or later; the findings provide one fixed version and do not identify branch-specific targets or breaking changes, so review the vendor advisory and your upgrade documentation before scheduling production work.

If an upgrade must be delayed, restrict low-privilege access to the gateway and limit its database account to only the permissions required for normal operation. Review database query logs, application logs, and SAML assertion-related activity for unexpected queries, data changes, or errors after remediation. CISA has not added this CVE to the KEV catalog, so no CISA due date applies.

Technical context

CVE-2026-78623 has CVSS 7.7 (High): CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L. It is CWE-89 SQL injection over the network, requiring low privileges and an Okta Access Gateway instance configured with Advanced Mode datastore settings; SAML assertion values are interpolated into database queries before preparation. It is not listed in CISA KEV, there is no clear dated report of exploitation in the wild, and no public exploit code is on record. EPSS is 0.2% (15th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS36th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 36th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising, driven by in-the-wild reports.

Lifecycle

9 events over 14 days, from the signal feeds we watch.

2026-09-22Patch availablerecord updated
2026-09-10Patch availablerecord updated
2026-09-08Patch availablepublished, weakness classified, att&ck mapped, record updated

Affected products

Oktacommercial · USaka okta verify, okta-sdk-java
- access gatewaySaaSSecurity Products / identity-access-mgmt
- Okta Access GatewaySaaSSecurity Products / identity-access-mgmt

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Scored 7.7 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service